---
title: "Acknowledge Alerts"
method: POST
path: "/connect/events/ack"
tags: ["Query"]
---

# Acknowledge Alerts

`POST /connect/events/ack`

Acknowledges the alert event(s) matching the given query. Note that this will not remove the event from connected SOC users' Alert screens when the same alert event happens to be also present on their Alert screen. However, if they refresh the Alert screen the alert event will no longer be listed.

## Request body

- ModelEventAckCriteria
  - `acknowledge` boolean — Whether to acknowledge or unacknowledge the events: true = acknowledge, false = unacknowledge
  - `dateRange` string — The date range to use for searching for matching events
  - `dateRangeFormat` string — The date range format. If unsure how to use this then use the example value exactly as shown.
  - `escalate` boolean — Whether the events have also been escalated to a case: true = escalated, false = has not been escalated
  - `eventFilter` object — Optional event filters to further narrow down matching events to acknowledge. These are field:value pairs.
  - `searchFilter` string — The search filter to utilize when searching for matching events to acknowledge.
  - `timezone` string — The timezone to use with the date range

## Response `200`

Outputs the list of update results

- ModelEventUpdateResults
  - `completeTime` string — The date and time when the search completed
  - `createTime` string — The date and time when the search was submitted
  - `criteria` ModelEventUpdateCriteria — The criteria used for performing the update
    - `async` boolean — Whether the update was performed asynchronously or not
    - `beginTime` string — The start of the search time range, in the requestor's timezone
    - `createTime` string — The UTC date and time when the search request was submitted
    - `dateRange` string — The date range to use for searching for matching events
    - `endTime` string — The end of the search time range, in the requestor's timezone
    - `eventLimit` integer — The maximum number of events to retrieve
    - `metricLimit` integer — The maximum number of metrics to limit in aggregate groups
    - `query` string — The base query used to conduct the event search
    - `updateScripts` string[] — Any scripts used in the event update
  - `elapsedMs` integer — The number of milliseconds it took to complete the search
  - `errors` string[] — A list of errors that the search encountered. The presence of errors does not necessarily preclude the search from returning events."
  - `unchangedCount` integer — The number of events the were left unmodified
  - `updatedCount` integer — The number of events that were updated

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `405` — The event module is not loaded on the server
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)